The register

All 25 clauses, from scope to the shared ISMS

Every page is written from the published 2020 edition, the baseline that edition 3 replaces. Each one states the duty in our words, the evidence a board or an auditor asks for, the common failures and the work to do before publication. Start where the governance is, not where the page numbers are.

25 clause records110 evidence lines84 failure lines13,630 authored words

Start at clause 6 The objectives Annexes

1. Scope and foundations

Clause	Record	The answer in one line
1	Scope	It is guidance for the people at the top on how to govern the security of information, and it works whether the security work sits inside an ISO/IEC 27001 management system or outside one.
2	Normative references	Two standards hold the definitions and requirements the guidance leans on: ISO/IEC 27000 for vocabulary and ISO/IEC 27001 for the management system.
3	Terms and definitions	Four terms carry the whole model: the entity, the organization, the governing body and top management. The boundary between them is the point.
4	Abbreviations	Only two abbreviations are defined, ISMS and IT, and the second one matters because the governance of IT and the governance of information security are not the same thing.
5	Use and structure	The guidance describes how security governance works inside an ISO/IEC 27001 management system and how it connects to governance outside it, through four processes: evaluate, direct, monitor and communicate.

6. Governance and management

Clause	Record	The answer in one line
6.1	Overview: governance and management of information security	Governance sets direction and control from the top; management achieves the objectives that direction sets. Effective security needs both roles played consistently.
6.2	Governance activities within the scope of an ISMS	ISO/IEC 27001 does not use the word governance, but its clauses 4 to 10 are governance activities, and each one can be mapped to one or more of the six objectives.
6.3	Other related standards	The guidance points to ISO/IEC 38500, the standard of guiding principles for governing bodies on the effective, efficient and acceptable use of information technology.
6.4	Thread of governance within the organization	Four threads run through the governance model: alignment, risk management, conflicts of interest, and preventing the organization technology from harming others.

7. Entity governance and the objectives

Clause	Record	The answer in one line
7.1	Overview	Security is one governance area among several, and it has to align with the others rather than sit outside them or swallow them.
7.2.1	Objective 1: Establish integrated, comprehensive, entity-wide information security	Security should be handled across the whole entity, with responsibilities and accountabilities that reach every activity, including information held by other parties.
7.2.2	Objective 2: Make decisions using a risk-based approach	Security decisions should rest on compliance duties and on the risk appetite of the entity itself, with security risk managed inside the entity risk framework rather than beside it.
7.2.3	Objective 3: Set the direction of acquisition	Security risk should be assessed before new activities, investments, purchases, mergers, technology adoption, outsourcing and supplier contracts, not after them.
7.2.4	Objective 4: Ensure conformance with internal and external requirements	Security policy and practice should conform to the requirements of interested parties, including law, regulation, contracts and internal commitments, with independent assurance where the board needs it.
7.2.5	Objective 5: Foster a security-positive culture	Security depends on people, so objectives, roles, responsibilities and resources have to point in the same direction, and top management has to require and support that coordination.
7.2.6	Objective 6: Ensure the security performance meets current and future requirements of the entity	The organization should know that its protection is fit for purpose, at an agreed level, and that performance is measured and maintained against current and future needs.
7.3.1	General	The governing body of the entity performs evaluate, direct, monitor and communicate, and top management is fully involved in the operation of the organization.
7.3.2	Evaluate	Evaluate looks at where the entity is heading against its objectives and decides what has to change, including which security objectives should be prioritised.
7.3.3	Direct	Direct is where the governing body sets strategy, risk appetite and resourcing, and top management allocates the investment, roles and policy that deliver it.
7.3.4	Monitor	Monitor is how the governing body learns whether the strategy is being achieved, and how management turns measurement into feedback, priorities and early warning.
7.3.5	Communicate	Communicate is a two-way exchange with interested parties: a statement of status, the explanation after an incident, and communication designed for the audience that has to understand it.

8. The governing body and the ISMS

Clause	Record	The answer in one line
8.1	Organization and ISMS	The governing body should require one or more management systems, approve each one with its scope and certification scope, set its direction and decide the residual risk it may carry.
8.2.1	Type A: The entity and the ISMS organization are the same	Where the entity and the system organization are one body, the board also leads the system, and the separation of policy setting from policy execution has to be created deliberately.
8.2.2	Type B: The entity contains the ISMS organization	Where the entity is larger than the management system organization, the same governing body can govern several systems, and each system has to be clear about whose objectives it serves.
8.2.3	Type C: One ISMS is shared by multiple entities	One management system can serve several entities, and its security objectives have to align with the mutual objectives that bind those entities together.

Reading the verbs. ISO/IEC 27014 is guidance: its clauses say should, not shall. The register keeps the distinction visible, so a governance gap is not confused with a nonconformity. What binds is what your own policy, contract or regulator requires. Clause 1.

THE RULES THIS IS BUILT FROM

Read from the real rules, not invented

Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.

25 CLAUSES

One page per clause

The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.

Open the register

3 ANNEXES

Guidance, clearly labelled

Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.

Open the annexes

ONE STAGE RECORD

No invented date

Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.

Read the record

The edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.